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On the Linear Ranking Problem for Integer 
Linear-Constraint Loops 

Amir M. Ben-Amram and Samir Genaim 
Abstract 

In this paper we study the complexity of the Linear Ranking prob- 
lem: given a loop, described by linear constraints over a finite set 
of integer variables, is there a linear ranking function for this loop? 
While existence of such a function implies termination, this problem 
is not equivalent to termination. When the variables range over the 
rationals or reals, the Linear Ranking problem is known to be PTIME 
decidable. However, when they range over the integers, whether for 
single-path or multipath loops, the decidability of the Linear Ranking 
problem has not yet been determined. We show that it is decidable, but 
harder than the former case: it is coNP-complete. However, we point 
out some special cases of importance of PTIME complexity. We also 
present complete algorithms for synthesizing linear ranking functions, 
both for the general case and the special PTIME cases. 

1 Introduction 

Termination analysis has received a considerable attention and nowadays 
several powerful tools for the automatic termination analysis of different pro- 
gramming languages and computational models exist [GTSKF044 ICPR061 
lAAG + 07 , ISMP10] . Much of the recent development in termination analysis 



has benefited from techniques that deal with one loop at a time, where a 
loop is specified by a loop guard and a (non-iterative) loop body. 

Very often, these loops are abstracted so that the state of the program 
during the loop is represented by a finite set of integer variables, the loop 
guard is a conjunction of linear inequalities, and the body modifies the 
variables in an affine linear way, as in the following example: 

while (a?2 — x\ < 0, x\ + X2 > 1) do X2 ■= X2 — 2x% + 1 (1) 

When the variables are modified in the loop body so that they are not 
affine linear functions of the old ones, the effect is sometimes captured (or 
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approximated) by means of linear constraints. E.g., the C language loop 
"while (4*x>=y && y>=l)do x=(2*x+l)/5;", which involves integer divi- 
sion, can be represented by linear constraints as follows (since 2*x+l is 
always positive) 

while (4^1 > X2,X2 > 1) do 5x[ < 2x\ + 1, 5x[ > 2x\ — 3, x' 2 = x<i (2) 

where tagged variables represent the values at the completion of an iteration. 
Linear constraints might also be used to model changes to data structures, 
the variables representing a size abstraction such as length of lists, depth 
of trees, etc. [L"597l ILJBAOll lBCG+071 ISMPlO] . For a precise definition of 



the loop representations we consider, see Sec. [2j they also include multipath 
loops where alternative paths in the loop body are represented. 

A standard technique to prove the termination of a loop is to find a 
ranking function. Such a function maps a program state (a valuation of 
the variables) into an element of some well-founded ordered set, such that 
the value descends (in the appropriate order) whenever the loop completes 
an iteration. Since descent in a well-founded set cannot be infinite, this 
proves that the loop must terminate. This definition of "ranking function" 
is very general; in practice, researchers have often limited themselves to a 
convenient and tractable form of ranking function, so that an algorithm to 
find the function — if there is one — might be found. 

It seems that the most frequently used class of functions is based on affine 
linear functions. In this case, we seek a function p(x±, . . . , x n ) = a\X\ + • • • + 
o- n x n + flO) with the rationals as a co-domain, such that (i) p(x) > for any 
valuation x that satisfies the loop guard; and (ii) p(x) — p(x') > 1 for any 
transition that starts in x and continues in x' . This automatically induces 
the piecewise-linear ranking function: f(x) = p(x) + 1 if x satisfies the loop 
guard and otherwise, with the non-negative rationals as a co-domain but 
ordered w.r.t. a ^ 6 iff a + 1 <b (which is well-founded). For simplicity, we 
call p itself a linear ranking function instead of referring to /. 

An algorithm to find a linear ranking function using linear programming 
(LP for short) was found by multiple researchers in different places and 
times and in some alternative versions [SG911 ICSOTl IPR04I IMS081 IADFG10] . 
Essentially, the observation of all these researchers was that a linear ranking 
function for such a loop can be derived by LP techniques. Since LP has a 
polynomial time complexity, the resulting method can be implemented in 
polynomial time. Moreover, since LP can precisely decide whether a given 
inequality is implied by a set of other inequalities, and even can be used to 
synthesize any implied inequality, this approach can, in a certain sense, be 
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sound and complete (after all, conditions (i) and (ii) above are inequalities 
implied by the constraints that define the loop guard and body). Soundness 
means that it produces a correct linear ranking function, if it succeeds; 
completeness means that if a linear ranking function exists, it will succeed. 
In other words, there are no false negatives. A completeness claim appears 
in some of the references, and we found it cited several times. In our opinion, 
it has created a false impression that the Linear Ranking problem for linear- 
constraint loops with integer variables was completely solved (and happily 
classified as polynomial time). 

The fly in the ointment is the fact that these solutions are only complete 
when the variables range over the rationals, which means that the linear 
ranking function has to fulfill its requirements for any rational valuation of 
the variables that satisfies the loop guard. But this may lead to a false 
negative if the variables are, in fact, integers. The reader may turn to the 
two loops above and note that both of them do not terminate over the 
rationals at all (for the first, consider x\ = x^ = |; for the second, x\ = \ 
and X2 = 1). But they have linear ranking functions valid for all integer 
valuations, which we derive in Sec. 13.41 

This observation has led us to investigate the Linear Ranking problem 
for single-path and multipath linear constraint loops. We present several 
fundamental results on this problem, which, surprisingly, are new (to our 
best knowledge). We have confirmed that this problem is indeed harder in 
the integer setting, proving it to be coNP-complete (as a decision problem), 
even for loops that only manipulate integers in a finite range. In a positive 
note, this shows that there is a complete solution, even if exponential-time. 
We give such a solution both to the decision problem and to the synthesis 
problem. Another positive news for the practically-minded reader is that 
some special cases of importance do have a PTIME solution, because they 
reduce (with no effort, or with a polynomial-time computation) to the ra- 
tional case. We present several such cases, which include, among others, 
loops in which the body is a sequence of linear affine updates with integer 
coefficients, as in loop ([I]) above; and the condition is defined by either an 
extended form of difference constraints, a restricted form of Two Variables 
Per Inequality constraints, or a cone (constraints where the free constant is 
zero). Some cases in which the body involves linear constraints are also pre- 
sented. All the algorithms presented in this paper have been implemented, 
and can be tried out online (see Sec. E]). 

These results should be of interest to all users of linear ranking func- 
tions, and in fact their uses go beyond termination proofs. For example, 
they have been used to bound the number of iterations of a loop in pro- 
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gram complexity analysis [AAGPlT] , and in loop parallelization [DarlO] , 
We remark that in termination analysis, the distinction between integers 
and rationals has already been considered, both regarding ranking-function 
generation [BMS05c] and the very decidability of the termination prob- 
lem [BAGM121 ITiw04l lB~ra06| . All these works left the integer case open. 

This paper is organized as follows. Sec. [2] gives definitions and back- 
ground information regarding linear constraint loops, linear ranking func- 
tions and the mathematical notions involved. Sec. [3] proves that the de- 
cision problem, denoted LinRF(Z), is coNP-complete, and also presents 
an exponential-time ranking-function synthesis algorithm. Sec. [5] discusses 
PTIME-solvable cases. Sec. [5] describes a prototype implementation. Sec. [6] 
surveys related previous work. Sec. [7] concludes. 

2 Preliminaries 

In this section we recall some results on (integer) polyhedra on which we 
will rely along the paper, define the kind of loops we are interested in, and 
formally define the linear ranking function problem for such loops. 

2.1 Integer Polyhedra 

We recall some useful definitions and properties which can all be found 
in [Sch86]. A rational convex polyhedron V C Q n [polyhedron for short) 
is the set of solutions of a set of inequalities Ax < b, namely V = {x € 
Q n | Ax < b}, where A £ Q mxn is a rational matrix of n columns and m 
rows, x € Q n and b € Q m are column vectors of n and m rational values 
respectively. We say that V is specified by Ax < b. We use calligraphic 
letters, such as V and Q to denote polyhedra. 

The set of recession directions of a polyhedron V specified by Ax < b is 
the set IZ-p = {y £ Q n \ Ay < 0}. For a given polyhedron V C Q n we let 
I(V) be V PI Z ra , i.e., the set of integer points of V. The integer hull of V, 
commonly denoted by Vi, is defined as the convex hull of I(V), i.e., every 
rational point of Vi is a convex combination of integer points. This property 
is fundamental to our results. It is known that Vi is also a polyhedron. An 
integer polyhedron is a polyhedron V such that V = Vi. 

Polyhedra also have a generator representation in terms of vertices and 
rayfl written as 

V = convhull{xi, . . . ,x m } + cone{yi, . . . ,y t } . 
1 Technically, the Xi, . . . , x n are only vertices if the polyhedron is pointed. 
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This means that x G V iff x = Y17=l a i ' x « + Sj=i • Yj for some ratio- 
nals di,bj > 0, where YliLi a i = 1- Note that yi, ... ,yt are the recession 
directions of V, i.e., y € TZ-p iff y = X^=i &j ' Yj fo r some rational 6j > 0. 
When V is an integer polyhedron, then there is a generator representation 
in which all Xj and yj are integer. 

Complexity of algorithms on polyhedra is measured in this paper by run- 
ning time, on a conventional computational model (polynomially equivalent 
to a Turing machine), as a function of the bit-size of the input. For a poly- 
hedron ?CQ n defined by Ax < b, we let \\V\\ b be the bit-size of Ax < b. 
The bit-size of an inequality a • x < c, where a = (aq, . . . , a n ), is defined as 

n 

||c|| + n + ||aj|| 
i=l 

we will be working mostly with integer coefficients, whose size is defined 
by 1 1 a; 1 1 = |~log(|xj + 1)]. The facet size, denoted by is the smallest 

number (ft > n such that V may be described by some Ax < b where each 
inequality in Ax < b fits in (ft bits. Clearly, \\V\\f < ||"P||6- The vertex 
size, denoted by ||"P||t,, is the smallest number v > n such that V has a 
generator representation in which each of Xj and y^ fits in v bits (the size of 
a vector is as above). For integer polyhedra, we restrict the generators to be 
integer. The following theorems may be found in [Sch86l Th. 10.2, p. 121] 
and |Sch86l Cor. 17.1a,17.1b, p. 238] (citing [KP80| ) respectively. 

THEOREM 2.1. Let V be a rational polyhedron in Q n ; then \\V\\ V < 
4n 2 \\V\\f and \\V\\f < 4n 2 ||P||„. 

THEOREM 2.2. Let V be a rational polyhedron in Q n ; then \\Vj\\ v < 
6n 3 \\V\\ f and \\Vi\\ f < 24n 5 ||7 3 ||/. 

2.2 Multipath linear-constraint loops 

A single-path linear-constraint loop (SLC for short) over n variables x\, . . . , x< 
has the form 

while (Bx < b) do A f * J < c (3) 

where x = {x%, . . . , x n ) T and x' = (x^, . . . , x' n ) T are column vectors, and for 
some p,q > 0, B G QP xn , A G Qi x2n , b G Q p , c G Q q . The constraint 
Bx < b is called the loop condition (a.k.a. the loop guard) and the other 
constraint is called the update. The update is called deterministic if, for a 
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given x (satisfying the loop condition) there is at most one x' satisfying the 
update constraint. The update is called linear if it can be rewritten as 

x' = A'x + c' (4) 

for a matrix A' and vector c' of appropriate dimensions. We say that the 
loop is a rational loop if x and x' range over Q n , and that it is an integer 
loop if they range over Z ra . 

We say that there is a transition from a state x € Q n to a state x' £ Q n , 
if x satisfies the condition and x and x' satisfy the update. A transition can 
be seen as a point ) G Q 2ra , where its first n components correspond to x 
and its last n components to x'. For ease of notation, we denote such points 
by x" = (x')- The set of all transitions x" £ Q 2ra will be denoted, as a rule, 
by Q. The transition polyhedron Q is specified by A"x" < c" where 



A" = 



B 0\ „ fh 

A 



Note that we may assume that Q does not include the origin, for if it in- 
cludes it, the loop is clearly non-terminating (this condition is easy to check). 
Hence, Q is not a cone (i.e., m > 1 in the generator representation). The 
polyhedron defined by the loop condition Bx < b will be denoted by C (the 
condition polyhedron). 

A multipath linear-constraint loop (MLC for short) differs by having 
alternative loop conditions and updates, which are, in principle, chosen 
non-deterministically (though the constraints may enforce a deterministic 
choice) : 

loop Bix < hi A\ — c i 

I # 2 x < b 2 A 2 Q < c 2 (5) 

• • • I B k x < b fc A k (^j < c k 

More precisely, the i-th update can be applied if the i-th condition is sat- 
isfied. Following the notation of SLC loops. The transitions of an MLC 
loop are specified by the transition polyhedra Qi, ■ ■ ■ , Qk, where each Qi is 
specified by A'(x" < c". The polyhedron defined by the condition i?jX < b« 
is denoted by C«. 

For simplifying the presentation, often we write loops with explicit equal- 
ities and inequalities instead of the matrix representation. We also might 
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refer to loops by their corresponding transition polyhedra, or the sets of 
inequalities that define these polyhedra. 

2.3 Linear Ranking Functions 

A linear function p : Q n — >• Q is a function of the form p(x) = A-x+Ao where 
A £ Q n is a row vector and Ao £ Q- For ease of notation we sometimes refer 
to a linear function using the row vector (A ,A) G Q n+1 . Next we define 
when a linear function is a linear ranking function (LRF for short) for a 
given rational or integer MLC loop. 

Definition 2.3. Given an MLC loop with Q\, . . . , Q). as transition polyhe- 
dra, and a linear function p(x) = A • x + Ao- We say that p is a LRF for 
Qi, . . . , Qk iff the following hold for any rational point 6 Qj 

A • x + A > (6) 

A • (x - x') > 1 (7) 

and we say that it is a LRF for /(Qi), . . .,I(Qk) iff (|6l7p hold for any integer 
point (*,) € /(Qi). 

Intuitively, © and ([7]) requires that p(x) > and /o(x) — /o(x') > 1 respec- 
tively. For rational loops this must hold for all rational transitions, and for 
integer loops it must hold for all integer transitions. Clearly, the existence 
of a LRF implies termination of the loop. 

Note that in Def. 12.31 we require p to decrease at least by 1, where in the 
literature |PR04] this 1 is sometimes replaced by 5 > 0. It is easy to verify 
that these definitions are equivalent. 

Definition 2.4. The decision problem Existence of a LRF is defined by 
Instance: an MLC loop. 

Question: does there exist a LRF for this loop? 
The decision problem is denoted by LinRF(Q) and LinRF(Z) for rational 
and integer loops respectively. 

It is known that LinRF(Q) is PTIME-decidable [PR041 IMS081 IADFG10] . 
In this paper, we focus on LinRF(Z). 

3 The General Case is coNP-complete 

In this section we show that the LinRF(Z) problem is coNP-complete; it 
is coNP-hard already for SLC loops. We also show that LRFs can be 
synthesized in deterministic exponential time. 
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This section is organized as follows: in Sec, 13.11 we show that LinRF(Z) 
is coNP-hard; in Sec. 13.21 we show that it is in coNP for SLC loops, and 
in Sec. 13.31 for MLC loops; finally, in Sec. 13.41 we describe an algorithm for 
synthesizing LRFs. 

3.1 coNP-hardness 

We prove coNP-hardness in a strong form. Recall that a number problem (a 
problem whose instance is a matrix of integers) Prob is strongly hard for a 
complexity class, if there are polynomial reductions from all problems in that 
class to Prob such that the values of all numbers created by the reduction 
are polynomially bounded by the input bit-size. Assuming NP^P, strongly 
NP-hard (or coNP-hard) problems cannot even have pseudo-polynomial al- 
gorithms [GJ79| . 

THEOREM 3.1. The LinRF(Z) problem is strongly coNP-hard, even for 
deterministic SLC loops. 

Proof. The problem of deciding whether a polyhedron given by Bx < b 
contains no integer point is a well-known coNP-hard problem (an easy re- 
duction from SAT may be found in [Kar72]). We reduce this problem to 
LinRF(Z). 

Given B € Z mxn and b 6 Z m , we construct the following integer SLC 
loop 

- (o :i) <- (o) * $ - © 

where x = (xi, . . . , x n ) T , z = (z±, . . . , z m ) T are integer variables, and I is an 
identity matrix of size m x m. 

Suppose Bx < b has an integer solution x. Then, it is easy to see that 
the loop does not terminate when starting from this x and z set to 0, since 
the guard is satisfied and the update does not change the values. Thus, it 
does not have any ranking function, let along a LRF . 

Next, suppose Bx < b does not have an integer solution. Then, for 
any initial state for which the loop guard is enabled it must hold that 
Z\ + • • • + z n > 0, for otherwise Zi,...,z n must be in which case the 
constraint Bx — Iz < b has no integer solution. Since the updated vector 
z' is deterministically set to 0, the guard will not be enabled in the next 
state, hence the loop terminates after one iteration. Clearly z\ + • • • + z n > 
z[ + • • • + z' n = 0, so we conclude that Z\ + • • • + z n is a LRF. □ 
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Note that in the above reduction we rely on the hardness of whether a 
given polyhedron is empty. This problem is coNP-hard even for bounded 
polyhedra (due to the reduction from SAT in which variables are bounded by 
and 1). This means that even for loops that only manipulate integers in a 
rather small range, the problem is coNP-hard. The parameter "responsible" 
for the exponential behavior in this case is the number of variables. 

3.2 Inclusion in coNP for SLC loops 

To prove that LinRF(Z) is in coNP, we show that the complement of 
LinRF(Z), the problem of nonexistence of a LRF, is in NP, that is, has 
a polynomially-checkable witness. In what follows we assume as input an 
SLC loop with a transition polyhedron Q C Q 2 ™. The input is given as the 
set of linear inequalities A"x" < c" that define Q. The proof follows the 
following lines: 

1. We show that there is no LRF for I(Q) iff there is a witness that 
consists of two sets of integer points X C I(Q) and Y C I(TZq), such 
that a certain set of inequalities ^/y/s{X ,Y) has no solution over the 
rationals; and 

2. We show that if there is a witness then there is one with bit-size 
polynomial in the input bit-size. 

To make sense of the following definitions, think of a vector (Ao,A) € Q n+1 as 
a "candidate LRF" that we may want to verify (or, in our case, to eliminate). 

Definition 3.2. We say that x" = (*/ ) £ I(Q) is a witness against (Ao,A) € 
Qn+i jf £ a jj g ^ sa ti s fy a ^ least one of conditions ([6]) and ([7]). The set of 
(Ao,A) witnessed against by x" is denoted by W(x"). 

Definition 3.3. We say that y" = (y/) G I(1Zq) is a homogeneous witness 
(h-witness) against (Ao,A) G Q n+1 if it fails to satisfy at least one of 

A-y>0 (8) 
A • (y - y') > (9) 

The set of (Ao,A) h-witnessed against by y" is denoted by Wh{y")- 

Definition 3.4. Given two sets of integer points X C I(Q) and Y C I(TZq), 
define 

WS(X,Y) = |J W(x") U |J W H (y") . (10) 
x"ei y "eY 
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LEMMA 3.5. Let X C J(Q) and F C I(7£q). // WS(X,Y) = Q n+1 , then 
there is no LRF for L(Q). 

Proof. Let WS(X,Y) = Q n+1 - For any (A ,A) G Q n+1 , we prove that p(x) = 
A • x + A is not a LRF. If (A ,A) G PF(x") for some x" G X, then the 
conclusion is clear since conditions (|6l7p do not hold. Otherwise, suppose 
that (Ao,A) G Wn(y") for y" G Y. Thus, y" fails to satisfy one of conditions 
(|8l9p . Next we show that, in such case, there must exists z" G L(Q) that 
fails either ([6]) or ([7]). 

Case 1: Suppose ([8|) is not satisfied. That is, A • y < 0. 

Choose an arbitrary x" = (*') G L{Q), and assume that p(x) > 0, 
since otherwise p fails © and is not a LRF. Note that for any integer 
a > 0, the integer point z" = x" + a ■ y" is a transition in L(Q), and 

z" = (z0 = (xw)- We choose a = + /°( x ))/(^ • y)l. which is a 

positive integer, and thus a ■ (A • y) < — (1 + p(x)). Now, 

p(z) = A • (x + a ■ y) + A 

= p(x) + a • (A • y) < p(x) - (1 + p(x)) = -1 

So p fails ([6]) on z" G -^(Q), and thus cannot be a LRF. 

Case 2: Suppose ([9]) is not satisfied. That is, A ■ (y — y') < 0. 

Choose an arbitrary x" = ( x /) G L(Q), and assume that p(x) — /o(x') > 
1, since otherwise p fails (|7|) and is not a LRF. Let a = [~— (1 + p(x) — 
p(x'))/(A • (y — y'))]i a positive integer, and define z" as above. We have 
a ■ (A • (y - y')) < -(1 + p(x) - p(x')). Now, 

p(z)-p(z / ) = A-((x + a-y)-(x' + a-y / )) 

= p(x)-p(x') + a-(A-( y -y')) 

< p(x) - p(x') - (1 + p(x) - p(x')) = -1 

So p fails ([7]) on z" G I(Q), and thus cannot be a LRF. □ 

Note that the condition WS(X,Y) = Q n+1 is equivalent to saying that 
the conjunction of inequalities (|6l7p . for all x" G X, and inequalities (|8l9p . 
for all y" G Y, has no (rational) solution. We denote this set of inequalities 
by &ws(X ,Y). Note that the variables in Wy^s{X ,Y) are Ao, • • • , A n , which 
range over Q, and thus, the test that it has no solution can be done in 
polynomial time. 
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EXAMPLE 3.6. Consider the following integer SLC loop: 

while (x± > 0) do x[ = x± + x 2 , x' 2 = x 2 — I 

Let x'/ = (0,2,2,1) T € J(Q) and y'/ = (1,-2,-1, - 2) T € I(7£ Q ). Then, 
lPws({x'(},{y"}) is a conjunction of the inequalities 

{2A 2 + A > 0, - 2Ai + A 2 > 1, Ai - 2A 2 > 0, 2Ai > 0} (11) 

The first two inequalities correspond to applying (|6|7|) to x", and the other 
ones to applying (|8l9p to y". It is easy to verify that (fTTj) is not satisfiable, 
thus, WS ({x"} ,{y'{}) = Q 3 and the loop does not have a LRF. This is a 
classical loop for which there is no LRF. 

Lemma 13.51 provides a sufficient condition for the nonexistence of LRF, 
the next lemma shows that this condition is also necessary. In particular, 
it shows that if there is no LRF for I(Q), then the vertices and rays of Qi 
serve as X U Y of Lemma 13.51 

LEMMA 3.7. Let Qi = convhull{xi', . . . ,x£J + cone{y^, . . . ,y" } be the 

integer hull of the transition polyhedra Q. If there is no LRF for I(Q), then 

WS({x'>,...,^},{y>{,...,y'>}) = ® n+1 - 

Proof. We prove the contra-positive. Suppose that 

^5({x' 1 ',...,<},{y;',..., y n)^Q n+1 - 

Then, there is (A ,A) G Q n+1 that fulfills (JSED for all x? and (HI]) for all yjf. 

We claim that p(x) = A • x + Ao is a LRF for I(Q). 

To see this, let x" = be an arbitrary point of I(Q). Then x" = 

Y^hLi a i ■ x i + 12j=i bj ■ y'j for some ai, bj > where YlT=i a* = !• Now, we 
show that x" and p satisfy ()6|7p which means that p is a LRF for I(Q): 

m t 

A • x + A =A + Oj • (A • Xj) + 2J • (A • y?) 

i=i j=i 

m t 

= ^ a t • (A • Xj + A ) + ^ • (A • y,-) 
i=i j=i 

>0 + = 

m t 

A-(x-x')=^a,.(A.(x J -xO) + ^6 J .(A-(y J - y ;.)) 
i=i j=i 

>l + = 1 

□ 
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Note that the solutions of Wwsifa'li ■ ■ ■ , x m}>{yi > • • • > Yt }) i n Lemma l377l 
actually define the set of all LRFs for I(Q). We will address this point later 
in Sec. 13.41 for synthesizing LRFs. 

EXAMPLE 3.8. Consider again the loop of Ex. and recall that it does 
not have a LRF. The generator representation of Qi is 

Qi = convhulljx'/} + cone{y", y 2 ' , y^'} 

where x'/ = (0,1,1,0)* y'{ = (0, -1, -1, -1) T , y» = (0,1,1,1)* and y» = 
(1,-1,0,-1) T . Then, <F WS ({*'{}, {y'{,y'^y%}) is a conjunction of the fol- 
lowing inequalities 

A 2 + A > -A 2 > A 2 > Ai - A 2 > , . 

-Ai + A 2 > 1 Ai > -Ai > Ai > [ ' 

The inequalities in the leftmost column correspond to applying (|6I7|) to x'/, 
and those in the other columns to applying (|8l9p to y'{, y 2 ', and y^' respec- 
tively. It is easy to verify that (|12p is not satisfiable, which is equivalent to 
saying that WS ({*'(} ,{y>( , y 2 ', y£}) = Q 3 . 

Lemmas 13.51 and 13.71 provide a necessary and sufficient condition for the 
nonexistence of LRF. 

COROLLARY 3.9. There is no LRF for I(Q), iff there are two sets 
X C J(Q) and Y C L(TZ V ) such that WS(X,Y) = Q n+1 . 

Proof. Combine lemmas 13.51 and 13.71 □ 

The next lemma concerns the bit-size of the witness. 

LEMMA 3.10. If there exists a witness for the nonexistence of LRF for 
I{Q), there exists one with X C I(Q) and Y C I(1Zq) such that \X U Y \ < 
n + 1; and the bit-size of X U Y is polynomial in the bit-size of the input. 

Proof. Recall that by Lemma l3.7[ if I(Q) has no LRF, then 

WS(M,...,^},{y'l,...,y'n) = Q n+1 

or, equivalently, ^wsd^i, ■ ■ ■ > x m}){yii • • • jYt'}) has n o solution. A corol- 
lary of Farkas' Lemma |Sch86[ p. 94] states that: if a set of inequalities 
over Q n has no solution, there is a subset of at most n inequalities that has 
no solution. Since the set of inequalities ^jys({ x i> . . . , x^jjjy", . . . , yf }) is 
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over Q n , there is a subset of at most n + 1 inequalities that has no solu- 
tion. This subset involves at most n + 1 integer points out of {x!{, . . . , x^} 
and {y'(, . . . , y"}. Let these points be X U Y, then \X U Y\ < n + 1 and 
W WS {X,Y) has no solution, i.e., WS{X,Y) = Q n+1 - 

Now we show that X L)Y may be chosen to have bit-size polynomial 
in the size of the input. Recall that the input is the set of inequalities 
A"x." < b that define Q, and its bit-size is ||Q||f>. Recall that the points 
of X U Y in Lemma 13.71 come from the generator representation, and that 
there is a generator representation in which each vertex/ray can fit in 
bits. Thus, the bit-size of X U Y may be bounded by (n + 1) • ||Q/||„. By 
Theorem 12. 2 \ since the dimension of Q is 2n, 

(n + 1) • \\Qi\\ v < (n + 1) • (6- (2n) 3 • ||Q||/) < 96n 4 • ||Q|| 6 

which is polynomial in the bit-size of the input. □ 

EXAMPLE 3.11. Consider 9 ws ({^{},{y'{,y^,y^}) of Ex. [313 It is easy 
to see that the inequalities — A2 > 0, Ai > and — Ai + A2 > 1 are enough 
for unsatisfiability (n + 1 inequalities, since n = 2). These inequalities cor- 
respond to x" and y'{, and thus, they form a witness for the nonexistence of 
LRF since #Vs({ x i}>{yi}) is unsatisfiable. Note that this witness consists 
of less than n + 1 points (since n = 2). Note also that in Example 13.61 we 
have another witness that consists of 2 points, in which the points do not 
come from the generator representation. 

THEOREM 3.12. LinRF(Z) G coNP for SLC loops. 

Proof. We show that the complement of LinRF(Z) has a polynomially 
checkable witness. The witness is a listing of sets X and Y of at most 
n + 1 elements and has a polynomial bit-size (specifically, a bit-size bounded 
as in Lemma |3.1U|) . Verifying a witness consists of the following steps: 

Step 1 : Verify that each x" £ X is in I(Q), which can be done by verifying 
A"x." < c"; and that each y" 6 Y is in I(TZq), which can be done by 
verifying A"y" < 0. This is done in polynomial-time. Note that according 
to Lemma 13.51 it is not necessary to check that X and Y come from a 
particular generator representation. 

Step 2: Verify that WS(X,Y) = Q n+1 . This can be done by checking that 
^wsiX ,Y) has no solutions, which can be done in polynomial-time since it 
is an LP problem over Q n+1 . □ 
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3.3 Inclusion in coNP for MLC loops 

In this section we consider the inclusion in coNP for MLC loops. For this, 
we assume an input MLC loop with transition polyhedra Qx, ■ ■ ■ , Qk where 
each Qi is specified by A'-x" < c". 

The proof follows the structure of the SLC case. The main difference 
is that points of the witness X L) Y may come from different transition 
polyhedra. Namely, X = X\ U ■ ■ ■ U X k and Y = Y\ U • • • U Y k where each 
Xi C I{Qi) and Y { C I(K Qi ). Lemmas ESI EZ3 and IBTTUl Cor. EES and 
Th. 13.121 are rewritten in terms of such witnesses as follows. 

LEMMA 3.13. Let X = X 1 U • • • U X k and Y = Yi U • • • U Y k , where 
Xi C I(Qi) and Yi C I{K Qi ). If WS(X,Y) = Q n+1 , then there is no LRF 
forI(Qx),...,I(Q k ). 

Proof. The proof is as that of Lemma 13.51 □ 

LEMMA 3.14. For 1 < i < k, let Qn = convhull{Xi} + cone{Yj} be the 
integer hull of Qi, and define X = X\ U • • • U X k and Y = Y\ U • • • U Y k . If 
there is no LRF for I(Q{), . . .,I(Q k ), then WS(X,Y) = Q n+1 - 

Proof. The proof follows that of Lemma 13.71 We pick (Ao,A) G Q n+1 as we 
do there and show that p(x) = A • x + Ao is a LRF for each I(Qj). This is 
accomplished by performing the same calculation, however referring to Xi 
and Yi when proving that p is a LRF for I(Qj). □ 

COROLLARY 3.15. There is no LRF for I(Qi), I(Q k ), iff there are 
two sets X = Xi U • • • U X k and Y = Yi U • • • U Y k , where Xi C J(Qj) and 
Yi C I(K Qi ), such that WS(X,Y) = Q n+1 . 

Proof. Combine lemmas 13.131 and 13.141 □ 

LEMMA 3.16. If there exists a witness for the nonexistence of LRF for 
I(Qi), . . . , I(Qk), then there exists one, with X = X\ U • • • U X k and Y = 
YiU • • -U Y k , where Xi C I(Qi) and Y { C I(TZ Qi ), such that \Xll Y\ < n + l; 
and the bit-size of X U Y is polynomial in the bit-size of the input. 

Proof. The proof is as in Lemma 13.101 Note that the input here consists of 
k sets of inequalities, and there are k sets of n + 1 inequalities each. □ 

THEOREM 3.17. LinRF(Z) G coNP. 
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Proof. The difference from that of Th. 13.121 is that the witness is given as 
X = Xi U • • • U X k and Y = Y x U • • • U Y k . Thus, the verifier should use the 
appropriate set of inequalities to check that each x" G Xi is in I(Qi), and 
that each y" G Yi is in L{TZ Qi ). □ 

EXAMPLE 3.18. Consider the following integer MLC loop 

loop X\ > 0, X2 > => x'i = x\ — 1 

I Xi > 0, X 2 > => x' 2 = X2 — 1, = X\ 

It is a classical MLC loop for which there is no LRF . The integer hull of 
the corresponding transition polyhedra are 

Q u = convhullK) + cone{yi', y», y%, y'l) 
Q21 = convhull{x' 2 '} + cone{y' 5 ' , yg} 

where x'{=(0, 0, -1, 0) T , x 2 '=(0, 0, 0, -1) T , yi'=(0, 0, 0, -1) T , y 2 '=(0, 0, 0, 1) T , 
y'i = (0,1,0,0) T , y'i = (1,0,1,0) T , y» = (0,1,0,1) T and y 6 ' = (1,0,1,0) T . 
Let us first consider each path separately. We get 

<%s(K},{y^y 2 ',y£}) ={A > 0,Ai > 1,A 2 > 0, -A 2 > 0} (13) 
9ws{{A}M>y'l,yz}) ={Ao > 0,A 2 > 1} (14) 

Both (|13p and (|14p are satisfiable. In fact, their solutions define the cor- 
responding LRFs for each path when considered separately. For the MLC 
loop, we have that !?jys({ x i> x^'j^y'/, . . . ,y 6 '}) is the conjunction of the in- 
equalities in ()13p and (|14p . which is not satisfiable. Thus, while each path 
has a LRF, the MLC loop does not. Note that the inequalities A 2 > 1 and 
— A 2 > are enough to get unsatisfiability of (|13ll4p . thus, X = {x 2 } and 
Y = {y 2 } is a witness, and consists of less than n + 1 points (here n = 2). 

3.4 Synthesizing a linear ranking function 

Although the existence of a LRF suffices for proving termination, generating 
a complete representation of the LRF is important in some contexts, for 
instance complexity analysis where a ranking function provides an upper 
bound on the number of iterations that a loop can perform. In this section 
we give the first complete algorithm that generates LRFs for MLC loops 
given by transition polyhedra Qi, ■ ■ ■ , Qk- The following lemma is directly 
implied by lemmas 13.131 and 13.141 
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LEMMA 3.19. For 1 < i < k, let the integer hull of Qi be Qu = 
convhull{Xj}+cone{yj}, and define X = X\U- ■ -UXfc and Y = Y\U- ■ -UYf,. 
Then, p(x) = A-x+Ao is a LRF for J(Qi), . . . ,I(Qk), 2/f (Ao,A) is a solution 
for W WS {X,Y). 

Proof. Straightforward by lemmas 13.131 and 13.141 □ 

The following algorithm is clearly implied: (1) Compute the generator 
representation for each Qu; (2) Construct !F\ys(X ,Y); and (3) Use LP to 
find a solution (Ao,A) for !l/\ys(X ,Y). 

EXAMPLE 3.20. Consider the following integer SLC loop 

while (— x\ + x 2 < 0, —x\ — x 2 < — 1) do x[ = x%,x 2 = x 2 — 2x\ + 1 (15) 

The integer hull of the transition polyhedron is 

Qj = convhullK,^} + cone{yi',yg} 

where x'/ = (1,1,1,0) T , x 2 ' = (1,0,1,-1) T , y'{=(l, 1, 1, -1) T , and y» = 
(1, — 1, 1, — 3) T . Then, !?i^s({ x i > x 2 }>{yi > 3^) ^ s conjunction of the fol- 
lowing inequalities (we eliminated clearly redundant inequalities) 

{Ai + A 2 + A > 0, Ai + A > 0, A x + A 2 > 0, Ai - A 2 > 0, A 2 > 1} (16) 

which is satisfiable for Ai = A 2 = 1 and Ao = — 1, and therefore, f{x\,x 2 ) = 
x i + x 2 — 1 is a LRF . Note that the loop does not terminate when the 
variables range over Q, e.g., for x\ = x 2 = \- 
Let us consider another SLC loop 

while (4xi > X2,X2 > 1) do 2x\ — 5x 1 < 3, — 2x\ + 5x[ < l,x 2 = x 2 (17) 

The integer hull of the transition polyhedron is 

Qi = convhullfx'/, x 2 , xg, X4, X5, Xg} + cone{y", y 2 } 

where x'/=(4, 16, 1, 16) T , x' 2 '=(l, 4, 0, 4) T , x' 3 '=(2, 8, 1, 8) T , x^=(l, 1, 0, 1) T , 
xg = (4, 1, 1, 1) T , x' 6 ' = (2, 1, 1, 1) T , y'{ = (5, 0, 2, 0) T and y 2 = (5, 20, 2, 20) T . 
Then, the set of inequalities ^^({x", . . . , Xgjjjy'/, y 2 }) is the conjunction 
of the following inequalities (we eliminated clearly redundant ones) 

f Ai > 1, 4Ai+A 2 +A > 0,4Ai+16A 2 +A > 0,2Ai+A 2 +A > 0, 1 
\Ai+4A 2 +A > 0, 2Ai+8A 2 +A > 0, 5Ai+20A 2 > 0, Ai+A 2 +A > 0j { ' 
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which is satisfiable for Ai = 1, A2 = and Ao = —1, and therefore, 
f(xi,X2) = x\ — 1 is a LRF. Note also that this loop does not terminate 
when the variables range over Q, e.g., for x\ = -t and X2 = 1. 

If we consider loops (fT5j) and (fT?]) as two paths in an MLC loop, then to 
synthesize LRFs we use the conjunction of the inequalities in (|16p and (|18p . 
In this case, Ai = A2 = 1 and Ao = —1, is a solution, but Ai = 1, A2 = 
and Ao = —1 is not. Therefore, f(xx,X2) = x\ + X2 — 1 is a LRF for both 
paths, and thus for the MLC loop, but not f(xi, X2) = x\ — 1. 

Naturally, given our hardness results, one cannot expect a polynomial- 
time algorithm. Indeed, constructing the generator representation of the 
integer hull of a polyhedron from the corresponding set of inequalities A'-x < 
c'( may require exponential time — the number of generators itself may be 
exponential. Their bit-size, on the other hand, is polynomial by Th. 12.21 
This is interesting, since it yields: 

COROLLARY 3.21. Given an MLC loop specified by the transition poly- 
hedra Qi, ■ ■ ■ , Qk, where each Qi is specified by A"x < c'- . If there is a LRF 
for I(Qi), • • • , I(Qk), there is one whose bit-size is polynomial in the bit-size 
of A'-x < c", namely in maxj || Qi 

Proof. As in the last section, we bound the bit-size of each of the generators 
of Qij by HQj/llu < 6(2n) 3 • ||Qi||/ < 48n 3 • ||Qj||& for an appropriate i. This 
means that the bit-size of each equation in )P\yg(X,Y), having one of the 
forms ©, (JU), ([8]), or © is at most 2 + 48n 3 • (max; ||Qi||&). Let V be the 
polyhedron defined by & W s(X,Y), then \\V\\ f < 2 + 48n 3 • (maxj ||Qi||b). If 
< F^s{X ,Y) has a solution, then any vertex of V is such a solution, and yields 
a LRF . Using Th. 12.11 with the above bound for \\V\\f and the fact that the 
dimension of V is n + 1 , we conclude that there is a generator representation 
for V in which the bit-size \\V\\ V of the vertices is bounded as follows: 

\\V\\ V < 4 - (n + l) 2 • \\V\\ f < 4- (n+ l) 2 • (2 + 48n 3 • (max \\Qi\\ b )) 

i 

This also bounds the bit-size of the corresponding LRF. □ 

4 Special Cases in PTIME 

In this section we discuss cases in which the LinRF(Z) problem is PTIME- 
decidable. We start by a basic observation: when the transition polyhedron 
of an SLC loop is an integer polyhedron, the LinRF(Z) and LinRF(Q) 
problems are equivalent. 
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LEMMA 4.1. Let Q be a transition polyhedron of a given SLC loop, and 
let p be a linear function. If Q is an integer polyhedron, then p is a LRF 
for Q iff p is a LRF for I(Q). 

Proof. Let Q be an integer polyhedron. (=>) Suppose that p is a LRF for 
Q, then clearly it is also a LRF for I(Q) since I{Q) C Q. (<^) Suppose that 
p is a LRF for I(Q), it thus satisfies (|6|7p of Def. 12.31 for any integer point 
in Q. However, by definition of an integer polyhedron, every rational point 
in Q is a convex combination of integer points from I(Q), this proves that p 
satisfies conditions (|6I7|) for any rational point as well. To see this, choose an 
arbitrary rational point x" = ( */ ) £ Q. It can be written as x" = ]P a • x-' 

where <n > 0, £ a* = 1 and xj' G I(Q). Thus, x" = (*, ) = ( ) , and 

p(x) =(A • y^aj ■ Xj) + A 

= ^ a, • (A • xi + A ) > 

p(x) - p(x') =(A • 5^ ai • Xi) - (A • 5^ o» • x-) 
= Oj • A • (xj - x-) > 1 

□ 

The above lemma provides an alternative complete procedure for the 
LinRF(Z) problem, namely, compute a constraint representation of its in- 
teger hull Qj and solve LinRF(Q). This will be particularly useful if it 
is guaranteed that the transition polyhedra is integer; or if computing its 
integer hull is easy. 

EXAMPLE 4.2. Consider again the SLC loop JUJ of Ex. 1X201 The 

transition polyhedron is not integer, computing its integer hull adds the 
inequalities —xi+x[ < —1 and \x\— < 4. This is depicted in FigureDjC), 
however, for clarity, we consider there only two dimensions, by projecting 
the constraints on xi and x' 1: since it is hard to see it in four dimensions. 
Applying LinRF(Q) on this loop does not find a LRF since it does not 
terminate when the variables range over Q, however, applying it on the 
integer hull finds the LRF f(x\,x%) = x\ — 1. 

COROLLARY 4.3. The LinRF(Z) problem is PTIME-decidable for SLC 
loops in which the transition polyhedron Q is guaranteed to be an integer 
polyhedron. This also applies to any class of polyhedra where the integer 
hull is P TIME- computable. 
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Figure 1: The integer hulls of some polyhedra. The dashed lines are those 
added when computing the integer hull; the dotted areas represent the in- 
teger hull; the gray are the rational points eliminated when computing the 
integer hull. 

Proof. Immediate from Lemma [4. II and the fact that LinRF(Q) is PTIME- 
decidable. □ 

COROLLARY 4.4. The LinRF(Z) problem is P TIME- decidable for SLC 
loops in which the condition polyhedron C is guaranteed to be an integer poly- 
hedron, and the update is linear with integer coefficients. This also applies 
to any class of polyhedra where the integer hull is PTIME-computable. 

Proof. We show that in such case the transition polyhedron Q is, in fact, an 
integer polyhedron, and thus, Cor. l4,3l applies. Let the condition polyhedron 
C be an integer polyhedron, and the update be x' = A'x+d where the entries 
of A' and c' are integer. Let x" = ( */ ) G Q, that is, x G C and x' = A'st+d . 
Since C is an integer polyhedra, x is a convex combination of some integer 
points. I.e, x = a\ ■ Xj where aj > 0, Yl a i = 1 an d x i G Hence, 
x' = A'(Y1 ai ■ Xi) + d = Yl a i ■ ( A ' x i + c ') and 

V x 7 tH ■ {A'*i + d)J ^ \A'xi + d) 

Now note that (^'x'+c') are i n teger points from I(Q), which implies that 
x" is a convex combination of integer points in Q. Hence, Q is an integer 
polyhedron. □ 

Corollaries 14.31 and 14.41 suggest looking for special cases of SLC loops 
where we can ascertain that Q is an integer polyhedron, or that its integer 
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hull can be computed in polynomial time. In what follows we address such 
cases: Sec. 14.11 discusses special cases in which the transition or condition 
polyhedra are integer by construction; Sec. 14.21 shows that for certain cases 
of two-variables per inequality constraints the integer hull can be computed 
in a polynomial time; Sec. 14.31 discusses the case of octagonal relations; 
Sec. 14.41 shows that for some cases LinRF(Z) is even strongly polynomial; 
and Sec. 14.51 extends the results to MLC loops. 

4.1 Loops specified by integer polyhedra 

There are some well-known examples of polyhedra that are known to be 
integer due to some structural property. This gives us classes of SLC loops 
where LinRF(Z) is in PTIME. The examples below are all from [Sch86| . 
where the proofs of the lemmas can be found. 

LEMMA 4.5. For any rational matrix B, the cone {x | Bx < 0} is an 
integer polyhedron. 

COROLLARY 4.6. The LinRF(Z) problem is P TIME- decidable for SLC 
loops of the form 

while (Bx < 0) do x' = A'x + c' 

where the entries in A' and c' are integer. 

Recall that a matrix A is totally unimodular if each sub determinant of 
A is in {0, ±1}. In particular, the entries of such matrix are from {0, ±1}. 

LEMMA 4.7. For any totally unimodular matrix A and integer vector b, 
the polyhedron V = {x j Ax < b} is an integer polyhedron. 

For brevity, if a polyhedron V is specified by Ax < b in which A is a 
totally unimodular matrix and b an integer vector, we say that V is totally 
unimodular. 

COROLLARY 4.8. The LinRF(Z) problem is PTIME- decidable for SLC 
loops in which (1) the transition polyhedron Q is totally unimodular; or (2) 
the condition polyhedron C is totally unimodular and the update is linear 
with integer coefficients. 

As a notable example, difference bound constraints [BA08, BP12 |[BIK12| 
are defined by totally unimodular matrices. Such constraints have the form 
x — y < d with d € Q; constraints of the form ±x < d can also be admitted. 
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In the integer case we can always tighten d to \_d\ and thus get an integer 
polyhedron. 

It might worth mentioning that checking if a matrix is totally unimodular 
can be done in polynomial time }Sch861 Th. 20.3, p. 290]. 

4.2 Two-variable per inequality constraints 

In this section we consider cases in which the input loop involves two variable 
per inequality constraints (TVPI for brevity), i.e., inequalities of the form 
ax + by < d with a,b,d E Q. Clearly, polyhedra defined by such inequalities 
are not guaranteed to be integer. Such case is depicted in Figure [T^B). 

Harvey [Har99] showed that for two-dimensional polyhedra, which are 
specified by TVPI constraints by definition, the integer hull can be com- 
puted in 0(m log A max ) where m is the number of inequalities and A max is 
the magnitude of the largest coefficient. 

Definition 4.9. Let T be a set of TVPI constraints. We say that T is 
a product of independent two-dimensional TVPI constraints (PTVPI for 
brevity), if it can be partitioned into T±, . . . ,T n such that (1) each Tj is 
two-dimensional, i.e., involves at most two variables; and (2) each distinct 
Tj and Tj do not share variables. 

LEMMA 4.10. The integer hull of PTVPI constraints can be computed in 
polynomial-time. 

Proof. According to [Sch86l Sec. 16.3, p. 231], a polyhedron V is integer if 
and only if each of its faces has an integer point. A face of V is obtained by 
turning some inequalities to equalities such that the resulting polyhedron 
in not empty (over the rationals). Clearly, if T\ and T2 are two sets of 
inequalities that do not share variables, and their faces have integer points, 
then all faces of T\ U T2 have integer points. Thus, T\ U T2 is an integer 
polyhedron. Partitioning T into independent Ti, . . . ,T n and checking that 
each is 2-dimensional can done in polynomial-time. Computing the integer 
hull of each Tj can be done in polynomial-time using Harvey's method. □ 

The above approach can easily be generalized. Given any polyhedron, 
we first decompose it into independent sets of inequalities, in polynomial- 
time (these are the connected components of an obvious graph), and then 
check if each set is covered by one of the special cases for which the integer 
hull can be efficiently computed. 
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COROLLARY 4.11. The LinRF(Z) problem is P TIME- decidable for SLC 
loops in which: (1) the transition polyhedron Q is PTVPI ; or (2) the con- 
dition polyhedron C is PTVPI, and the update is linear with integer coeffi- 
cients. 

EXAMPLE 4.12. Consider the following SLC loop, as an example for 
case (1) of Cor. [QT1 

while (4»i > 1, x 2 > 1) do 2x\ - 5x[ < 3, -2x x + 5x[ < 1, x' 2 = x 2 + 1 (19) 

Applying LinRF(Q) does not find a LRF since the loop does not terminate 
when the variables range over Q, e.g., for x\ = j and x 2 = 1- The transition 
polyhedron is not integer, however, it is PTVPI since it can be divided into 
Ti = {4xi > l,2xi - 5xi < 3,-2xi + 5x[ < 1} and T 2 = {x 2 > l,x' 2 = 
x 2 +l}. Note that T 2 is already an integer polyhedron, computing the integer 
hull of T\ adds the inequalities — x\ + x' x < —1 and |xi — x\ < ^. This is 
depicted in FigureQjC). Now LinRF(Q) finds the LRF /(xi,x 2 ) = x 1 -l. 
Note that although x 2 does not affect the termination of the above loop, 
it is not safe to remove it. This is in particular true in the case of MLC 
loops, where it might affect the termination due to the interaction with other 
paths. 

EXAMPLE 4.13. Consider the following loop, as an example for case (2) 

of Cor. urn 

while {—x\ + x 2 < 0, — 2xi — x 2 < —1, X3 < 1) do , . 

x[ = xi, x' 2 = x 2 — 2xi + a?3> x' 3 = x 3 

Applying LinRF(Q) does not find a LRF since it does not terminate when 
the variable range over Q, e.g., for x\ = x 2 = \ and X3 = 1. The condition 
polyhedron is not integer, but it is PTVPI since it can be divided into 
T\ = {— x\ + x 2 < 0, — 2xi — x 2 < —1} and T 2 = {X3 < 1}. Note that 
T 2 is already an integer polyhedron, computing the integer hull of Ti adds 
x\ > 1. This is depicted in Figure QTB). Now LinRF(Q) finds the LRF 
/(xi, x 2 , X3) = 2xi + x 2 — 1. Note that the update in this loop involves 
constraints which are not TVPI. 

4.3 Octagonal relations 

TVPI constraints in which the coefficients are from {0,±1} have received 
considerable attention in the area of program analysis. Such constraints are 
called octagonal relations [Min06j. A particular interest was in developing 
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efficient algorithms for checking satisfiability of such relations, as well as 
inferring all implied octagonal inequalities. For cases in which the variables 
range over Q, as well as over Z. 

Over Q, this is done by computing the transitive closure of the relation, 
which basically adds inequalities that result from the addition of two ex- 
isting inequalities, and possibly scaling to obtain coefficients of ±1. E.g., 
starting from the set of inequalities {— x\ + X2 < 0, —x\ — X2< —1}, we add 
— 2xi < — 1, or, after scaling, —x\ < —\. Over Z, this is done by comput- 
ing the tight closure, which in addition to transitivity, is closed also under 
tightening, which is the replacement of ax + by < d by ax + by < [d\ . For 
example, tightening —x\ < — \ yields —x\ < — 1. The tight closure can be 
computed in polynomial-time [HS97t BHZ08a] IRev09j . Since the tight clo- 
sure eliminates fractional points, it is tempting to expect that it computes 
the integer hull. It is easy to show that this is true for two-dimensional 
relations, however, it is false already in three dimensions, as we show in the 
following example. 

EXAMPLE 4.14. Consider the following loop 

while (x\ + x 2 < 2, x\ + x 3 < 3, x 2 + x 3 < 4) do . . 

x' x = 1 — Xx, X 2 = 1 + Xl,x' 3 = 1 + X2 

Note that the transition polyhedron is octagonal, however, it is not an in- 
teger polyhedron. Applying LinRF(Q) does not find a LRF, since the 
loop does not terminate over Q, e.g., for xx = \, X2 = I, and x% = |. 
Computing the tight closure does not change the transition (or condition) 
polyhedron, and thus, it is of no help in finding the LRF . In order to obtain 
the integer hull of the transition (or condition) polyhedron we should add 
xx + X2 + X3 < 4, which is not an octagonal inequality. Having done so, 
LinRF(Q) finds the LRF f(xx,x 2 ,x 3 ) = -3xx - 4x 2 - 2x 3 + 12. 

Although it is not guaranteed that the tight closure of an octagonal 
relation corresponds to its integer hull, in practice, it does in many cases. 
Thus, since it can be computed in polynomial time, we suggest computing 
it before applying LinRF(Q) on loops that involve such relations. The 
above example shows that this does not give us a complete polynomial-time 
algorithm for LinRF(Z) over octagonal relations. 

EXAMPLE 4.15. Consider Loop (JUJ) of Ex. E2Q]in which the condition 
is an octagonal relation. LinRF(Q) fails to find a LRF since it does not 
terminate when the variables range over Q. Computing the tight closure 
of the condition adds x > 1, which in turn makes it integer polyhedron. 
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This is depicted in FigureQjA). Now LinRF(Q) finds the LRF f(xi,x 2 ) = 
x\ + X2 — 1. Let us consider another example with higher dimensions 

while (— X1+X2 < 0, —xi — X2 < — 1, X2 — £3 < 0, — X2 — x% < — 1) do 
x[ = x\,x' 2 = x 2 - x\ - x 3 + 1, x' 3 = x 3 

The condition is octagonal, but not an integer polyhedron, moreover, it is not 
PTVPI . LinRF(Q) does not find a LRF, since the loop does not terminate 
when the variables range over Q, e.g., for x\ = X2 = £3 = \- Computing 
the tight closure of the condition adds —x\ < —1 and — X3 < 0, which 
makes it integer polyhedron. Now LinRF(Q) finds the LRF f(x\, X2, £3) = 

X\ + X 2 - 1. 

A polynomial-time algorithm for computing the integer hull of octagonal 
relations is, unfortunately, ruled out by examples of such relations whose 
integer hulls have exponentially many facets. 

THEOREM 4.16. There is no polynomial-time algorithm for computing 
the integer hull of general octagonal relations. 

Proof. We build an octagonal relation O, such that the minimum number 
of inequalities required to describe its integer hull Oi is not polynomial in 
the number of inequalities in O. 

For a complete graph K n = (V,E), we let V be defined by the set of 
inequalities {x e > | e S E} U {^2 vGe x e < l\v € V}. Here every edge 
e € E has a corresponding variable x e , and the notation v 6 e means that 
v is a vertex of edge e. Note that V is not octagonal. It is well-known 
that Vi, the matching polytope of K n , has at least (!!) +2 n_1 facets [Sch86, 
Sec. 18.2, p. 251], and thus any set of inequalities that defines Vi must 
have at least the same number of inequalities. Now let O be defined by 
{x e > I e € E} U {x ei + x e2 < 1 | v G ei,v G 62}, which includes 
n + n- C^ 1 ) octagonal inequalities. It is easy to see that the integer solutions 
of V and O are the same, and thus Vi = Oj. This means that any set 
of inequalities that define Oi must have at least + 2 n_1 inequalities. 
Therefore, any algorithm that computes such a representation must add at 
least (2) + 2 n_1 -n-n ■ ( n 2 1 ) inequalities to O, which is super-polynomial 
in the size of O. Unsurprisingly, the tight closure of O does not yield its 
integer hull (it only adds x e < 1 for each x e ). □ 

Note that the above theorem does not rule out a polynomial-time algo- 
rithm for LinRF(Z), for SLC loops in which the transition polyhedron Q is 
octagonal, or where the condition polyhedron is octagonal and the update is 
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linear with integer coefficients. It just rules out an algorithm that is based on 
computing the integer hull of the polyhedra. However, the coNP-hardness 
proof of Sec. 13.11 could be also carried out by a reduction from 3SAT that 
produces an SLC loop where the condition is octagonal and the update is 
linear with integer coefficients — so at least for this class there is, presumebly, 
no polynomial solution. We present this reduction next 

THEOREM 4.17. The LinRF(Z) problem is strongly coNP-hard, even 
for deterministic SLC loops where the guard is octagonal. 

Proof. We exhibit a polynomial-time reduction from 3SAT to the comple- 
ment of LinRF(Z) (keeping all the numbers in the resulting instance poly- 
nomially bounded, to obtain strong coNP-hardness). 

Consider a 3SAT instance given as a collection of m clauses, Cx, ■ ■ ■ , C m , 
each clause Q consisting of three literals L\ G {x±, . . . , x n , x\, ■ ■ ■ , x n }. 

We construct a loop over 4m variables. Variable Xij corresponds to 
Is-. Variable Xio is a control variable to ensure the satisfaction of clause 
j, as will be seen below. Let C be the set of all conflicting pairs, that is, 
pairs ((i, j), (r, s)) such that L\ is the complement of Lf., and also pairs 
((i, j), (i,j')) with 1 < j < f < 3. The loop we construct is: 



while y\ x^ + x rs < 1 A f\ < x^ < 1 

\((i,j),(r,s))eC J \l<i<m, 0<j<3 

do f\ x'^ = x^ J A I y\ x' i0 = x i0 + Xix + x i2 + x a - 1 

y l<i<m, l<j<3 J yi<i<m 

Suppose the formula is satisfiable. For every clause, choose a satisfied 
literal, and set the corresponding variable x^ to 1; let all other variables be 
zero. Observe that all the inequality constraints are fulfilled, and that the 
value of each x' i0 does not change. Hence, the loop does not terminate, and 
does not have any ranking function, let alone a LRF. 

Next, suppose the formula is unsatisfiable. An initial state for which the 
loop guard is enabled may be interpreted as a selection of non-conflicting 
literals. Since no such selection can satisfy all clauses, looking at the update 
of the Xio variables, we see that some may stay unchanged, while some (and 
at least one) will decrease. It follows that Yli X M is a LRF. □ 
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4.4 Strongly polynomial cases 



Polynomial-time algorithms for LinRF(Q) |PR04l IM5081 lADFGlOj inherit 
their complexity from that of LP. While it is known that LP can be solved 
by a polynomial-time algorithm, it is an open problem whether it has a 
strongly polynomial algorithm. Such an algorithm should perform a number 
of elementary arithmetic operations polynomial in the dimensions of the 
input matrix instead its bit-size (which accounts for the size of the matrix 
entries), and such operations should be performed on numbers of size which 
is polynomial to the input bit-size. However, there are some cases for which 
LP is known to have a strongly polynomial algorithm. We first use these 
cases to define classes of SLC loops for which LinRF(Q) has a strongly 
polynomial algorithm, which we then use to show that LinRF(Z) has a 
strongly polynomial algorithm for some corresponding classes of SLC loops. 
Our results are based on the following result by Tardos [Tar86] (quoted 
from |Sch861 p. 196]). 

THEOREM 4.18 (Tardos). There exists an algorithm which solves a given 
rational LP problem max{c • x | Ax < b} with at most P{size{A)) ele- 
mentary arithmetic operations on numbers of size polynomially bounded by 
size(A, b, c), for some polynomial P. 

Note that the number of arithmetic operations required by the LP al- 
gorithm only depends on the bit-size of A. Clearly, if we restrict the LP 
problem to cases in which the bit-size of the entries of A is bounded by a 
constant, then size(A) depends only on its dimensions, and we get a strongly 
polynomial time algorithm. In particular we can state the following. 

COROLLARY 4.19. There exists a strongly polynomial algorithm to solve 
an LP problem max{c • x | Ax < b} where the entries of A are {0, ±1, ±2}. 

We can use this to show that LinRF(Q) can sometimes be implemented 
with strongly polynomial complexity. To do this, we use the Podelski- 
Rybalchenko formulation of such procedure [PR04] , slightly modified to re- 
quire that the LRF decreases at least by 1 instead of by some 5 > 0. 

THEOREM 4.20 (Podelski-Rybalchenko). Given an SLC loop with a 
transition polyhedron Q C Q 2n , specified by A"x" < c" , let A" = (A A') 
where each A and A' has n columns and m rows, and let jl, ff be row vectors 
of different m rational variables each. A LRF for Q exists iff there is a 
(rational) solution to the following set of constraints 
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ft,v> o T 

fl-A' = T 



(22a) 
(22b) 
(22c) 
(22d) 
(22e) 



ff-(A + A') = T 
ff- c" < -1 



THEOREM 4.21. The LinRF(Q) problem is decidable in strongly poly- 
nomial time for SLC loops specified by A"x" < c" where the coefficients of 
A" are from {0, ±1}. 

Proof. First observe that, in Th. 14.201 when the matrix A" has only entries 
from {0, ±1}, then all coefficients in the constraints (|22aH22dj) are from 
{0, ±1, ±2}. Moreover, the number of inequalities and variables in (|22aH22d|) 
is polynomial in the dimensions of A" . Now let us modify the Podelski- 
Rybalchenko procedure such that instead of testing for feasibility of the 
constraints (!22aH22e"|) , we consider the minimization of ff ■ c" under the other 
constraints ([22aH22d~|h Clearly, this answers the same question since: (|22ab 
I22ep is feasible, iff the minimization problem is unbounded, or the minimum 
is negative. This brings the problem to the form required by Cor. 14.191 and 
yields our result. □ 

COROLLARY 4.22. The LinRF(Z) is decidable in strongly polynomial 
time for SLC loops, specified by A"x" < c" , that are covered by any of the 
special cases of Sees. \4-l\ and \4-2\ and the entries of A" are from {0, ±1}. 

Proof. Regards the cases of Sec. 14. H the transition polyhedron is guaranteed 
to be integer. Regards the PTVPI case of Sec. 14.21 (1) the integer hull can 
be computed using Harvey's procedure, which is strongly polynomial in this 
case since the entries of A are from {0, ±1}. This can be done also using 
the tight closure of 2-dimensional octagons; and (2) the TVPI constraints 
that we add when computing the integer hull have coefficients from {0, ±1}, 
and the number of such constraints is polynomially bounded by the number 
of the original inequalities. Thus, by Th. 14.21} we can apply a strongly 
polynomial-time algorithm for LinRF(Q). □ 

4.5 Multipath loops 

Recall that a linear function p is a LRF for an MLC loop with transition 
polyhedra Q%, . . . , Q^, iff it is a LRF for each Qj. Thus, if we have the set 
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of LRFs for each Qi, we can simply take the intersection and obtain the 
set of LRFs for Qi, . . . , Q^. In the Podelski-Rybalchenko procedure, the 
set of solution of the inequalities (|22aH22e"j) defines the set of LRFs for the 
corresponding SLC loop as follows. 

LEMMA 4.23 ([PR04]). Given an SLC loop with a transition polyhedron 
Q, specified by A"x." < c" , let A(/x, if, A", c") be the conjunction of \22aV 
\EEEj) . Then, p(x) = A • x + A is a LRF for Q iff A(/2, ff, A", c") has a 
solution such that A = fj ■ A' and Xq > fl ■ c" . 

The following lemma shows how to compute, using the above lemma, 
the intersection of sets of LRFs for several transition polyhedra, and thus 
obtain the set of LRFs for a given MLC loop. 

LEMMA 4.24. Given an MLC loop with transition polyhedra Qi, ■ ■ ■ , Qk, 
each specified by A'-x." < c'- , let A(/7j, ffi, A'-, c'[) be the constraints Il22a[\22e}) 
for the i-th path, and (Ao,A) be n + 1 rational variables. Then, there is a 
LRF for Qi, ■ ■ ■ , Qk, iff the following is feasible (over the rationals) 

k 

/\ A(#, m, A'l, 4) A A = ffi ■ A[ A A > & ■ c'l (23) 
i=i 

Moreover, the values of (Ao,A) in the solutions of (f23|) define the set of all 
LRFs for Qx,...,Q k . 

Proof. Immediate by Lemma 14.231 noting that for each i the constraints 
A(f2i,rfi, A'- ,c'l) uses different /2j and rji, while (Ao,A) are the same for all 
i. □ 

COROLLARY 4.25. The LinRF(Q) problem for MLC loops is PTIME- 
decidable. 



Proof. The size of the set of inequalities (|23h is polynomial in the size of the 
input MLC loop, and checking if it has a rational solution can be done in 
polynomial-time. □ 

COROLLARY 4.26. The LinRF(Z) problem for MLC loops is PTIME- 
decidable when each path corresponds to one of the special cases, for SLC 
loops, discussed in Sees. \4-l\ andU~l 



Proof. Immediate, since if the transition polyhedra are integer, LinRF(Z) 
and LinRF(Q) are equivalent. □ 
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EXAMPLE 4.27. Consider an MLC loop with the following two paths: 
Loop (USD of Ex. [3T201 and the loop of Ex. l4~T2l Applying LinRF(Q) (as 
in Lemma I4.24j) does not find a LRF since both paths do not terminate 
when the variables range over Q. If we first compute the integer hull of 
both paths, LinRF(Q) finds the LRF f(x 1 ,x 2 ) = Sx 1 + x 2 - 2. Note that 
the integer hull of the first path is computable in polynomial-time since the 
condition is PTVPI and the update is linear with integer coefficients. That 
of the second path is also computable in polynomial-time as in Ex. 14.121 

5 Prototype Implementation 

The different algorithms presented in this paper, both for the general case 
and the special PTIME cases, have been implemented. It can be tried 
out via |http : / / wwuT loopkiller . Tom/ irankf inder[ where all examples of 
this paper are also available. The tool receives as input an MLC loop in 
constraints representation, and allows applying LinRF(Z) or LinRF(Q). 
The implementation includes the algorithms of Lemmas 13.191 and 14.241 By 
default it uses the second one since the first one requires generating the 
generator representation of the transition polyhedron, which is exponential. 

Computing the integer hull of a polyhedron, in the case of LinRF(Z), is 
done by first decomposing its set of inequalities into independent sets, and 
then computing the integer hull of each set separately. Each set of inequli- 
ties is first matched against one of the PTIME cases of Sees. 14.11 and 14.21 
If this matching fails, it computes the integer hull using Hartmann's algo- 
rithm [Har88j as explained by Charles et al. [CHK09J. Note that this algo- 
rithm supports only bounded polyhedra, the integer hull of an unbounded 
polyhedron is computed by considering a corresponding bounded one |Sch86, 
Th. 16.1, p. 231]. In addition, for octagonal relations, it gives the possibil- 
ity of computing the tight closure instead of the integer hull. As we have 
seen in Sec. 14.31 when this option is used, completeness of LinRF(Z) is not 
guaranteed. The Parma Polyhedra Library [BHZ08b] is used for convert- 
ing between generator and constraints representations, solving (mixed) LP 
problems, etc. 

6 Related work 

There are several works [SG9T1 ICSOil IPR041 IMS081 lADFClOj that directly 
address the LinRF(Q) problem for SLC or MLC loops. In all these works, 
the underlying techniques allow synthesizing LRFs and not only deciding if 
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one exists. The common observation to all these works is that synthesising 
LRFs can be done by inferring the implied inequalities of a given polyhe- 
dron (the transition polyhedron of the loop), in particular inequalities like 
conditions © and (|7|) of Def. [231 that define a LRF. Regarding complete- 
ness, all these methods are complete for LinRF(Q) but not for LinRF(Z). 
They can also be used to approximate LinRF(Z) by relaxing the loop such 
that its variables range over Q instead of Z, thus sacrificing completeness. 
All these methods have a corresponding PTIME algorithm. An exception 
in this line of research is the work of Bradley et al. [BMS05cJ that directly 
addresses the LinRF(Z) problem for MLC loops. Their proposed solution 
is not complete. Below we overview the essentials of all these works. 

Sohn and Van Gelder }SG91) considered SLC loops with variables rang- 
ing over N. These are abstractions of loops from logic programs. The loops 
were, in fact, relaxed from N to Q+ before seeking a LRF, however, this is 
not explicitly mentioned. The main observation in this work is that the du- 
ality theorem of LP }Sch86l p. 92] can be used to infer inequalities that are 
implied by the transition polyhedron. The authors also mention that this 
was observed before by Lassez [Las9Q] in the context of solving CLP(R) 
queries. Completeness was not addressed in this work, and the PTIME 
complexity was mentioned but not formally addressed. Later, Mesnard and 
Serebrenik [MS08J formally proved that the techniques of Sohn and Van 
Gelder [SG91| provide a complete PTIME method for LinRF(Q), also for 
the case of MLC loops. Here, it was clearly stated that it is not complete 
for LinRF(Z). 

Probably the most popular work on the synthesis of LRFs is the one of 
Podelski and Rybalchenko [PR04] . They also observed the need for deriving 
inequalities implied by the transition polyhedron, but instead of using the 
duality theorem of LP they used the affine form of Farkas' lemma |Sch86[ 
p. 93]. The soundness statement did not make it clear that the method is 
complete for LinRF(Q) but not for LinRF(Z). This was clearly stated, 
however, in the PhD thesis of Rybalchenko |Ryb04| . 

Bagnara et al. [ BMP Z 12] proved that the methods of Sohn and Van 
Gelder [MS08J and Podelski and Rybalchenko PRO 1 are actually equiv- 
alent, i.e., they compute the same set of LRFs. They also showed that 
the method of Podelski and Rybalchenko can, potentially, be more efficient 
since it requires solving rational constraints systems with fewer variables 
and constraints. 

Colon and Sipma [CSOl] were the first to use Farkas' lemma for solving 
the LinRF(Q) problem. They rely on the "homogeneous" lemma which 
states that A • x < is implied by Ax < iff A € conejai, . . . , a m } where cti 
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is the i-th row of A. Then, they extend this lemma to the inhomogeneous 
case Ax + b < 0, and state (without a proof) that A • x + Ao < is an im- 
plied inequality iff (A,A ) € cone{(0, 0, . . . , -1), (oi, h), . . . , (a m , b m )}. In 
fact, the later is the affine form of Farkas' lemma that was used by Podelski 
and Rybalchenko [PR04J. The authors did not claim that it can be imple- 
mented with a polynomial time algorithm, and indeed their implementation 
seems to have exponential complexity since they compute the polar of a gen- 
erator representation of cone{(0, 0, . . . , —1), (ai, . . . , (a n ,b n )}. However, 
clearly it has a polynomial-time algorithm, exactly the one of Podelski and 
Rybalchenko |PR04j . Also in this work completeness was claimed, however 
it was not explicitly mentioned that the variables range over Q and not Z 
(the programs in the examples used integer variables). In this work the in- 
put loop comes with an initial condition on the input, which is used to infer 
a supporting invariant. 

Bradley et al. [BMS05c] directly addressed the LinRF(Z) problem for 
MLC loops, and stated that the methods of Colon and Sipma [CS01] and 
Podelski and Rybalchenko |PR04j are not complete for LinRF(Z). Their 
technique is based on the observation that if there is a LRF, then there 
exists one in which each coefficient Aj has a value in the interval [—1,1], and 
moreover with denominators that are power of 2. Using this observation, 
they recursively search for the coefficients starting from a region defined by 
a hyper-rectangle in which each Aj is in the interval [—1,1]. Given a hyper- 
rectangle, the algorithm first checks if one of its corners defines a LRF, 
in which case it stops. Otherwise, the region is either pruned (if it can 
be verified that it contains no solution), or divided into smaller regions for 
recursive search. Testing if a region should be pruned is done by checking the 
satisfiability of a possibly exponential (in the number of variables) number 
of Presburger formulas. The algorithm will find a LRF if exists, but it might 
not terminate if no LRF exists. To make it practical, it is parametrized by 
the search depth, sacrificing completeness. It is interesting to note that the 
search-depth parameter in their algorithm actually bounds the bit-size of 
the ranking function coefficients. Our Cor. 13.211 shows that it is possible 
to deterministically bound this depth, that turning their algorithm into a 
complete one, though still exponential. In addition to LRFs, this technique 
is extended for inferring linear invariants over Z. 

The interest of Bradley et al. |BMS05c] was in MLC loops in which 
integer division by constants is allowed. It is incorrect to replace integer 
division x' = ^ by precise division, but the operation can be simulated by 
two paths of linear constraints: {x > 0, c ■ x' + y = x, < y < c — 1} and 
{x < 0, c • x' — y = x, < y < c — 1}. This illustrates the usefulness of 
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(multipath) constraint loops. 

Codish et al. }CLS05] studied the synthesis of LRFs for SLC loops with 
size-change constraints (i.e., of the form Xj > x'j + c where c € {0, 1}), 
and monotonicity constraints (i.e., of the form X < Y + c, where X and 
Y are variables or primed variables, and c G {0, 1}). In both cases the 
variables ranged over N. For size-change constraints, they proved that the 
loop terminates iff a LRF exists, moreover, such function has the form 
K • Xi with Xi € {0,1}. For the case of monotonicity constraints, they 
proved that the loop terminates iff a LRF exists for the balanced version 
of the loop, and has the form ^ Aj • Xi with Aj € {0,±1}. Intuitively, a 
balanced loop includes x\ < x'j + 1 (resp. x\ < x'j) iff it includes x\ < Xj + 1 
(resp. Xi < Xj) and vice versa. They showed how to balance the loop 
while preserving its termination behavior. Recently, Bozga et al. [BIK12| 
presented similar results for SLC loops defined by octagonal relations. 

Bradley et al. [BMS05a] extended the work of Colon and Sipma [CS01] 
and searched lexicographic LRFs. In [BMS05d, BMS05b] they considered 
multipath loops with polynomial transitions and the synthesis of lexico- 
graphic polynomial ranking functions, where the notion of ranking functions 
was also relaxed to functions that eventually decrease. Cousot [Cou05] used 
Lagrangian relaxation for inferring possibly non-linear ranking functions. In 
the linear case, Lagrangian relaxation is similar to the affine form of Farkas' 
lemma. 

Alias et al. [ADFG10] again rediscovered the Farkas-lemma based solu- 
tion for LinRF(Q). Like [BMS05a], they use it in constructing lexicographic 
LRFs, however, they do it for programs with an arbitrary control- flow graph, 
and they prove completeness of their procedure. Their goal was to use these 
functions to derive cost bounds (like a bound on the worst-case number 
of transitions in terms of the initial state); this bound is (when it can be 
found) a polynomial, whose degree is at most the dimension of the (range 
of the) lexicographic ranking function; Alias et al.'s construction produces a 
function of minimum dimension. They, too, have relaxed the problem from 
integers to rationals in order to work in a comfort zone where completeness is 
achievable using LP techniques, and failed to state that their completeness 
results depend on this relaxation. 

Decidability and complexity of termination (in general, not necessarily 
with LRFs) of SLC and MLC loops has been intensively studied for dif- 
ferent classes of constraints. For SLC loops, Tiwari |Tiw04) proved that 
the problem is decidable when the update is linear and the variables range 
over K. Braverman [Bra06] proved that this holds also for Q, and for the 
homogeneous case it holds for Z. Both considered universal termination. 
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Also, in both cases they allow the use of strict inequalities in the condition. 
Ben-Amram et al. [BAGM12] showed that the termination of SLC loops is 
at least EXPSPACE-hard, and that the problem is undecidable for some 
extensions that introduce a simple form of non-linearity; and also for SLC 
loops in which the use of a single irrational coefficient is allowed. See these 
works for references to additional results on the decidability of termination 
in other types of loops. 

7 Concluding Remarks 

We have studied the Linear Ranking problem for single-path and multipath 
linear constraint loops and observed the difference between the LinRF(Q) 
problem, where variables range over the rationals, and the LinRF(Z) prob- 
lem, where variables only take integer values. In practice, the latter is more 
common, but the decidability of the problem has not been studied before; 
the common approach has been to relax the problem to the rationals, where 
complete, polynomial-time decision procedures have been known. 

We have confirmed that LinRF(Z) is a harder problem, proving it to 
be coNP-complete. In a positive note, this shows that there is a complete 
solution, even if exponential-time. Another positive news for the practically- 
minded reader is that some special cases of importance do have a PTIME 
solution. 

The latter results arise from a proof that for integer polyhedra, LinRF(Z) 
and LinRF(Q) are equivalent. Interestingly, this is not the case for ter- 
mination in general. For example, the transition polyhedron of the loop 
" while x > do x' = 10 — 2x" is integer; the loop terminates when the 
variables range over Z but does not terminate when they range over Q, e.g., 
for x = 3|. Note that this loop does not have a LRF over the integers. 

A more general notion of ranking function applies to an arbitrary control- 
flow graph with transitions specified by source and target nodes as well as 
linear constraints on the values of variables. In this setting, one seeks to as- 
sociate a (possibly different) affine function p v with each node u, so that on 
a transition from v to v' we should have /9i/(x) > p„/(x'). Such functions can 
be found by LP, a procedure complete over the rationals, using a simple ex- 
tension of the solution for the loops we have discussed: see [MS08, ADFG10]. 
The considerations regarding the complexity of the corresponding problem 
over integers are essentially the same as those we have presented, and we 
preferred to use the simpler model for clearer presentation. 

In all examples that we have discussed in this paper, when a loop has a 
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LRF over Z but not over Q, then the loop did not terminate over Q. This is, 
however, not the case in general. A counter-example can be constructed by 
combining (i.e., executing simultaneously) the loop of Ex. [3761 and loop (|15p 
of Ex. 137201 

In the context of complexity analysis, there is a special interest in LRFs 
that decreases at least by 1 in each iteration since they bound the number of 
iterations of a given loop. In order to get tight bounds, even if Q has a LRF 
it might worth computing one for I(Q). To see this, let us add 4x\ > 3 to 
the condition of Loop (JEJ in Ex. EMI Then, both Q and I(Q) have LRFs. 
For I(Q) the most tight one is fi(xi,x%) = X\ + x<z — 1, while for Q it is 
f2(xi,x%) = 2x\ + 2x2 — 2. Note that f\ is a LRF for Q, but it does not 
always decrease at least by 1 and thus cannot be used directly to bound the 
number of iterations. 

Acknowledgments 

We thank Alain Darte for a helpful discussion. 



References 

[AAG + 07] Elvira Albert, Puri Arenas, Samir Genaim, German Puebla, 
and Damiano Zanardini. Costa: Design and implementation of 
a cost and termination analyzer for java bytecode. In Frank S. 
de Boer, Marcello M. Bonsangue, Susanne Graf, and Willem P. 
de Roever, editors, Formal Methods for Components and Ob- 
jects, FMCO'07, Revised Lectures, volume 5382 of LNCS, pages 
113-132. Springer, 2007. 

[AAGP11] Elvira Albert, Puri Arenas, Samir Genaim, and German 
Puebla. Closed-form upper bounds in static cost analysis. J. 
Autom. Reasoning, 46(2):161-203, 2011. 

[ADFG10] Christophe Alias, Alain Darte, Paul Feautrier, and Laure 
Gonnord. Multi-dimensional rankings, program termination, 
and complexity bounds of flowchart programs. In Radhia 
Cousot and Matthieu Martel, editors, Static Analysis Sympo- 
sium, SAS'10, volume 6337 of LNCS, pages 117-133. Springer, 
2010. 

[BA08] Amir M. Ben-Amram. Size-change termination with difference 
constraints. ACM Trans. Program. Lang. Syst., 30(3), 2008. 



34 



[BAGM12] Amir M. Ben-Amram, Samir Genaim, and Abu Naser Ma- 
sud. On the termination of integer loops. In Viktor Kuncak 
and Andrey Rybalchenko, editors, Verification, Model Check- 
ing, and Abstract Interpretation, VMCAF12, volume 7148 of 
LNCS, pages 72-87. Springer, 2012. 

[BCG + 07] Maurice Bruynooghe, Michael Codish, John P. Gallagher, 
Samir Genaim, and Wim Vanhoof. Termination analysis of 
logic programs through combination of type-based norms. ACM 
Trans. Program. Lang. Syst., 29(2), 2007. 

[BHZ08a] Roberto Bagnara, Patricia M. Hill, and Enea Zaffanella. An im- 
proved tight closure algorithm for integer octagonal constraints. 
In Francesco Logozzo, Doron Peled, and Lenore D. Zuck, edi- 
tors, Verification, Model Checking, and Abstract Interpretation, 
VMCAF08, volume 4905 of LNCS, pages 8-21. Springer, 2008. 

[BHZ08b] Roberto Bagnara, Patricia M. Hill, and Enea Zaffanella. The 
parma polyhedra library: Toward a complete set of numerical 
abstractions for the analysis and verification of hardware and 
software systems. Sci. Comput. Program., 72(l-2):3-21, 2008. 

[BIK12] Marius Bozga, Radu Iosif, and Filip Konecny. Deciding condi- 
tional termination. In Cormac Flanagan and Barbara Konig, 
editors, Tools and Algorithms for the Construction and Analysis 
of Systems, TACAS'12, volume 7214 of LNCS, pages 252-266. 
Springer, 2012. 

[BMPZ12] Roberto Bagnara, Fred Mesnard, Andrea Pescetti, and Enea 
Zaffanella. A new look at the automatic synthesis of linear 
ranking functions. Inf. Comput., 215:47-67, 2012. 

[BMS05a] Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. Linear 
ranking with reachability. In Kousha Etessami and Sriram K. 
Rajamani, editors, Computer Aided Verification, CAV'05, vol- 
ume 3576 of LNCS, pages 491-504. Springer, 2005. 

[BMS05b] Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. The 
polyranking principle. In Lui's Caires, Giuseppe F. Italiano, 
Luis Monteiro, Catuscia Palamidessi, and Moti Yung, editors, 
International Colloquium on Automata, Languages and Pro- 
gramming, ICALP'05, volume 3580 of LNCS, pages 1349-1361. 
Springer, 2005. 



35 



[BMS05c] Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. Ter- 
mination analysis of integer linear loops. In Martin Abadi and 
Luca de Alfaro, editors, Concurrency Theory, CONCUR 2005, 
volume 3653 of LNCS, pages 488-502. Springer, 2005. 

[BMS05d] Aaron R. Bradley, Zohar Manna, and Henny B. Sipma. Ter- 
mination of polynomial programs. In Radhia Cousot, editor, 
Verification, Model Checking, and Abstract Interpretation, VM- 
CAP05, volume 3385 of LNCS, pages 113-129. Springer, 2005. 

[BP12] Laura Bozzelli and Sophie Pinchinat. Verification of gap-order 
constraint abstractions of counter systems. In Viktor Kuncak 
and Andrey Rybalchenko, editors, Verification, Model Check- 
ing, and Abstract Interpretation, VMCAP12, volume 7148 of 
LNCS, pages 88-103. Springer, 2012. 

[Bra06] Mark Braverman. Termination of integer linear programs. In 
Thomas Ball and Robert B. Jones, editors, Computer Aided 
Verification, CAV'06, volume 4144 of LNCS, pages 372-385. 
Springer, 2006. 

[CHK09] Philip J. Charles, Jacob M. Howe, and Andy King. Integer poly- 
hedra for program analysis. In Andrew V. Goldberg and Yun- 
hong Zhou, editors, Algorithmic Aspects in Information and 
Management, AAIM'09, volume 5564 of LNCS, pages 85-99. 
Springer, 2009. 

[CLS05] Michael Codish, Vitaly Lagoon, and Peter J. Stuckey. Test- 
ing for termination with monotonicity constraints. In Maurizio 
Gabbrielli and Gopal Gupta, editors, International Conference 
on Logic Programming, ICLP'05, volume 3668 of LNCS, pages 
326-340. Springer, 2005. 

[Cou05] Patrick Cousot. Proving program invariance and termination 
by parametric abstraction, lagrangian relaxation and semidef- 
inite programming. In Radhia Cousot, editor, Verification, 
Model Checking, and Abstract Interpretation, VMCAP05, vol- 
ume 3385 of LNCS, pages 1-24, 2005. 

[CPR06] Byron Cook, Andreas Podelski, and Andrey Rybalchenko. Ter- 
mination proofs for systems code. In Michael I. Schwartzbach 
and Thomas Ball, editors, Programming Language Design and 
Implementation, PLDP06, pages 415-426. ACM, 2006. 



36 



[CS01] Michael Colon and Henny Sipma. Synthesis of linear ranking 
functions. In Tiziana Margaria and Wang Yi, editors, Tools 
and Algorithms for the Construction and Analysis of Systems, 
TACAS'01, volume 2031 of LNCS, pages 67-81. Springer, 2001. 

[DarlO] Alain Darte. Understanding loops: The influence of the decom- 
position of Karp, Miller, and Winograd. In Formal Methods and 
Models for Codesign, MEMO C ODE 7 1 0, pages 139-148. IEEE 
Computer Society, 2010. 

[GJ79] Michael R. Garey and David S. Johnson. Computers and In- 
tractability. W.H. Freeman and Co., New York, 1979. 

[GTSKF04] Jiirgen Giesl, Rene Thiemann, Peter Schneider-Kamp, and 
Stephan Falke. Automated termination proofs with aprove. 
In Vincent van Oostrom, editor, Rewriting Techniques and 
Applications, RTA '04, volume 3091 of LNCS, pages 210-220. 
Springer, 2004. 

[Har88] Mark E. Hartmann. Cutting Planes and the Complexity of the 
Integer Hull. PhD thesis, School of Operations Research and 
Industrial Engineering, Cornell University, 1988. 

[Har99] Warwick Harvey. Computing two-dimensional integer hulls. 
SI AM J. Comput., 28(6):2285-2299, 1999. 

[HS97] Warwick Harvey and Peter J. Stuckey. A unit two variable per 
inequality integer constraint solver for constraint logic program- 
ming. In Australasian Computer Science Conference, ACSC'97, 
pages 102-111, 1997. 

[Kar72] R. M. Karp. Reducibility among combinatorial problems. In 
R. E. Miller and J. W. Thatcher, editors, Complexity of Com- 
puter Computations, pages 85-103. Plenum Press, New York, 
1972. 

[KP80] Richard M. Karp and Christos H. Papadimitriou. On linear 
characterizations of combinatorial optimization problems. In 
Symp. on Foundations of Computer Science, FOCS'80, pages 
1-9. IEEE Computer Society, 1980. 

[Las90] Jean-Louis Lassez. Querying constraints. In Symposium on 
Principles of Database Systems, pages 288-298. ACM Press, 
1990. 



37 



[LJBA01] Chin Soon Lee, Neil D. Jones, and Amir M. Ben-Amram. The 
size-change principle for program termination. In Chris Han- 
kin and Dave Schmidt, editors, Symposium on Principles of 
Programming Languages, POPL'01, pages 81-92, 2001. 

[LS97] Naomi Lindenstrauss and Yehoshua Sagiv. Automatic termi- 

nation analysis of Prolog programs. In Lee Naish, editor, In- 
ternational Conference on Logic Programming, ICLP'97, pages 
64-77. MIT Press, 1997. 

[Min06] Antoine Mine. The octagon abstract domain. Higher- Order 
and Symbolic Computation, 19(1):31-100, March 2006. 

[MS08] Frederic Mesnard and Alexander Serebrenik. Recurrence with 
affine level mappings is p-time decidable for clp(r). TPLP, 
8(1):111-119, 2008. 

[PR04] Andreas Podelski and Andrey Rybalchenko. A complete 
method for the synthesis of linear ranking functions. In Bern- 
hard Steffen and Giorgio Levi, editors, Verification, Model 
Checking, and Abstract Interpretation, VMCAI'04, volume 
2937 of LNCS, pages 239-251. Springer, 2004. 

[Rev09] Peter Z. Revesz. Tightened transitive closure of integer addi- 
tion constraints. In Vadim Bulitko and J. Christopher Beck, 
editors, Symposium on Abstraction, Reformulation, and Ap- 
proximation, SARA'09, 2009. 

[Ryb04] Andrey Rybalchenko. Temporal Verification with Transition 
Invariants. PhD thesis, Universitat des Saarlandes, 2004. 

[Sch86] Alexander Schrijver. Theory of Linear and Integer Program- 
ming. John Wiley and Sons, New York, 1986. 

[SG91] Kirack Sohn and Allen Van Gelder. Termination detection in 
logic programs using argument sizes. In Daniel J. Rosenkrantz, 
editor, Symposium on Principles of Database Systems, pages 
216-226. ACM Press, 1991. 

[SMP10] Fausto Spoto, Fred Mesnard, and Etienne Payet. A termination 
analyzer for java bytecode based on path-length. ACM Trans. 
Program. Lang. Syst., 32(3), 2010. 



38 



[Tar86] Eva Tardos. A strongly polynomial algorithm to solve com- 
binatorial linear programs. Operations Research, 34:250-256, 
1986. 

[Tiw04] Ashish Tiwari. Termination of linear programs. In Rajeev 
Alur and Doron Peled, editors, Computer Aided Verification, 
CAV'04, volume 3114 of LNCS, pages 387-390. Springer, 2004. 



39 



